{"id":"AZL-109311","summary":"CVE-2026-98642 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk\n\nSyzkaller repeatedly triggered UAF splats related to nodes in\nwaiting_for_gp_ttrace within the bpf memalloc:\n\nBUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61\nRead of size 8 at addr ffff8881572cd080 by task syz.4.470/5112\n ...\n llist_del_first+0x85/0x110 lib/llist.c:61\n alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229\n bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436\n\nFreed by task 14:\n ...\n __free_rcu kernel/bpf/memalloc.c:281 [inline]\n __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291\n rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571\n rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621\n rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651\n\nThe reason is that the UAF occurs after the RCU Tasks Trace GP expires:\nwhen the __free_rcu() callback runs, there is no synchronization\nprotecting llist_del_all() against concurrent alloc_bulk() operating on\nwaiting_for_gp_ttrace, leading to the race condition below:\n\nCPU0                                           CPU1\n                                               __free_rcu (RCU Tasks Trace callback)\nalloc_bulk\n  llist_del_first(&c-\u003ewaiting_for_gp_ttrace)\n    entry = smp_load_acquire(&head-\u003efirst);\n    do {\n      if (entry == NULL)\n        return NULL;\n                                               free_all(llist_del_all(&c-\u003ewaiting_for_gp_ttrace))\n                                                 llist_for_each_safe(pos, t, llnode)\n                                                   free_one(pos);\n      next = READ_ONCE(entry-\u003enext); \u003c-- trigger UAF\n    } while (!try_cmpxchg(&head-\u003efirst, &entry, next));\n\nIn addition, there is also a theoretical race condition on the\nfree_by_rcu_ttrace list. This race requires two preconditions: an\nin-flight Tasks Trace GP keeping c-\u003ecall_rcu_ttrace_in_progress == 1,\nand concurrent cross-CPU frees repopulating c-\u003efree_by_rcu_ttrace with\nnew nodes. Under these conditions, the following scenario triggers UAF:\n\n// CPU0\n// irq work is still busy (on PREEMPT_RT)\nalloc_bulk()\n  llist_del_first(&c-\u003efree_by_rcu_ttrace)\n    entry = smp_load_acquire(&head-\u003efirst);\n    do {\n      if (entry == NULL)\n        return NULL;\n\n        // CPU1\n        bpf_mem_alloc_destroy()\n          WRITE_ONCE(c-\u003edraining, true)\n          // wait for CPU0\n          irq_work_sync()\n\n                // CPU2\n                do_call_rcu_ttrace(tgt(CPU0))\n                  if (c-\u003edraining) {\n                    llist_del_all(&c-\u003efree_by_rcu_ttrace)\n                    free_all()\n                  }\n\n// CPU0 continue\n      next = READ_ONCE(entry-\u003enext); \u003c-- trigger UAF\n    while (!try_cmpxchg(&head-\u003efirst, &entry, next));\n\nFix this by introducing a raw spinlock to synchronize the concurrent\nconsumption on waiting_for_gp_ttrace and free_by_rcu_ttrace.","modified":"2026-10-19T14:17:05.978824380Z","published":"2026-10-18T16:17:17Z","upstream":["CVE-2026-98642"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98642"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109311.json"}}],"schema_version":"1.9.0"}